IN THE UNITED STATES DISTRICT COURT 
FOR THE NORTHERN DISTRICT OF CALIFORNIA 



IN RE NATIONAL SECURITY AGENCY 
TELECOMMUNICATIONS RECORDS 
LITIGATION 



This Document Relates to: 



MDLDkt. No. 06-1791-VRW 

CLASSIFIED DECLARATION 
OF LT. GEN. KEITH B. 
ALEXANDER, DIRECTOR, 
NATIONAL SECURITY 
AGENCY 



Shubert v. Bush, Case No. 07-693 



SUBMITTED IN CAMERA, 
EX PARTE 



Hon. Vaughn R. Walker 



IN CAMERA, EX PARTE DECLARATION OF LIEUTANANT GENERAL KEITH B. 
ALEXANDER, DIRECTOR, NATIONAL SECURITY AGENCY 

(U) 1, Lieutenant General Keith B. Alexander, do hereby state and declare as follows: 



I. (U) Introduction 

1 . (IT) I am the Director of the National Security Agency (NSA), an intelligence 
agency within the Department of Defense. 1 am responsible for directing the NSA, overseeing 
the operations undertaken to carry out its mission and, by specific charge of the President and the 
Director of National Intelligence, protecting NSA activities and intelligence sources and 
methods. I have been designated an original TOP SECRET classification authority under 
Executive Order No. 12958, 60 Fed. Reg. 19825 (1995), as amended on March 25, 2003, and 
Department of Defense Directive No. 5200. 1-R, Information Security Program Regulation, 32 
C.F.R. § 159a. 12 (2000). 

2. (U) The purpose of this declaration is to support an assertion of the military and 
state secrets privilege (hereafter “state secrets privilege”) by the Director of National Intelligence 
(DNI) as the head of the intelligence community, as well as the DNFs assertion of a statutory 
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privilege under the National Security Act. Specifically, in the course of my official duties, I 
have been advised of this litigation and the allegations in the Plaintiffs’ complaint. As described 
herein, various classified facts related to the Plaintiffs’ claims are subject to the DNI’s state 
secrets privilege assertion. The disclosure of this information, which relates to NSA intelligence 
information, activities, sources, methods, and relationships, reasonably could be expected to 
cause exceptionally grave damage to the national security of the United States. In addition, it is 
my judgment that sensitive state secrets are so central to the subject matter of the litigation that 
any attempt to proceed in the case risks the disclosure of the secrets described herein and 
exceptionally grave damage to the national security of the United States. Through this 
declaration, I also hereby invoke and assert the NSA’s statutory privilege set forth in section 6 of 
the National Security Agency Act of 1959, Public Law No. 86-36 (codified as a note to 50 USC. 
§ 402) (“NSA Act”), to protect the information related to NSA activities described below. The 
statements made herein are based on my personal knowledge of NSA activities and operations, 
and on information available to me as Director of the NSA. 

II. (U) Summary 

3. (TS//SI//TSIV/OG/NF) Plaintiffs in this lawsuit allege that the NSA conducts a 
“dragnet” surveillance program involving the interception of “virtually every telephone, internet 
and/or email communication that has been sent from or received within the United States since 
2001.” Amended Compl. 1, 4. That allegation is false. As set forth below, there is no such 
“dragnet” program, 

Rather, as I have previously advised the Court, the NSA has conducted targeted 

content surveillance aimed at al Qaeda and affiliated terrorist organizations pursuant to the 

President’s Terrorist Surveillance Program (“TSP”) and recent orders of the Foreign Intelligence 
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Surveillance Court (“FISC” or “FISA Court”). As the Court is also aware, the NSA has 
collected, pursuant to Presidential authorization and subsequent FISC orders, non-content 
information (i.e., meta data) about telephone and Internet communications in order to enable 

highly sophisticated analytical tools that i 

other NSA activities do not constitute the dragnet that Plaintiffs allege, however, would require 
the disclosure of highly classified intelligence information, sources, and methods. Indeed, 
although the existence of the TSP has been acknowledged, the details of that program- — as well 
as the details of the related content surveillance authorized by the FISC — remain highly 
classified, and the meta data activities have never been acknowledged by the United States and 
likewise remain highly classified. 

4. P //OC/N F > In addition, Plaintiffs allege that Verizon and 

AT&T have cooperated in the alleged dragnet program. See Amended Compl. 5-8. Neither 
company assisted with the alleged dragnet program, because no such dragnet exists. 




5. 



the disclosure of 

-ould cause exceptionally grave damage to the national security. 

Accordingly, the protection of the classified 

information put at risk by this case, including the following is vital to the national security of the| 

United States: (1) any information that would tend to confirm or deny whether particular 
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1 individuals such as the named Plaintiffs have been subject to any NSA intelligence activities; 

2 (2) information about NSA intelligence activities, including facts demonstrating that the TSP 

3 was limited to al Qaeda-related international communications and was not a content surveillance 
dragnet as Plaintiffs allege; (3) facts that would tend to confirm or deny the existence of the 

5 NSA ’s meta data activities, and any information about (hose activities; and (4) the fact that 



disclosure or official confirmation of this information would cause exceptionally grave damage 

8 to the national security. 

9 6. (U) For these reasons, as set forth further below, the state secrets and statutory 

1 0 privilege assertions that the DNI and I are making should be upheld and the information 

1 1 described in this declaration should be protected from disclosure. I also believe that any further 

1 2 litigation of this case poses exceptionally grave risks to the national security. 

13 (U) Table of Contents 

14 7. P//0 C/N F) To facilitate the Court’s review, this 

1 5 declaration is organized as follows: 

16 I. Introduction 

17 II. Summary 

18 III. Classification of Declaration 

19 IV. Background Information 

20 A. The National Security Agency 

2 1 B. September 1 1 , 200 1 and the Continuing al Qaeda Threat 

22 V. Information Protected by Privilege 

23 VI. Description of Information Subject to Privilege and the Harm of Disclosure 
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Information That May Tend to Confirm or Deny Whether or Not the Plaintiffs 
Have Been Subject to Any Alleged NSA Activities That May Be at Issue in This 
Matter 



5 3. Harm of Disclosure 

6 B. Information Concerning NSA Activities, Sources, and Methods, and the Harm of 

Disclosure 

7 

1 . Information Concerning Plaintiffs’ Allegations of a Content Surveillance 

8 "Dragnet” 

9 2. Additional Classified Information Concerning the TSP 

10 3. Information Concerning Meta Data Activities 

11 4. Information Demonstrating the Success of TSP and Meta Data Activities 

12 5. Information Concerning the FISC Orders 

1 3 C. Information That May Tend to Confirm or Deny Whether Verizon/MCI 

and/or AT&T Has Assist^^^NS^with the Alleged Intelligence 

14 Activities, and theB 

15 VII. Risks of AJlowing Litigation to Proceed 

16 VIII. Summary and Conclusion 

17 III. (IT) Classification of Declaration 



8. -f$)-This declaration is classified TOP SECRET//COMINT- 



SP//ORCON/NOFORN//MR pursuant to the standards in Executive Order No. 

12958, as amended by Executive Order No. 13292. Under Executive Order No. 12958, 

information is classified ‘TOP SECRET’ if unauthorized disclosure of the information 

reasonably could be expected to cause exceptionally grave damage to the national security of (he 

United States; "SECRET’ if unauthorized disclosure of the information reasonably could be 
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expected to cause serious damage to national security; and "CONFIDENTIAL" if unauthorized 
disclosure of the information reasonably could be expected to cause identifiable damage to 
national security. At the beginning of each paragraph of this declaration, the letter or letters in 
parentheses designated) the degree of classification of the information the paragraph contains. 
When used for this purpose, the letters “U,” “C,” “S,” and ’TS” indicate respectively that the 
information ]S either UNCLASSIFIED, or is classified CONFIDENTIAL, SECRET, or TOP 
SECRET.' 

9. •(£) Additionally, this declaration also contains Sensitive Compartmcnted 

Information (SCI), which is “information that not only is classified for national security reasons 
as Top Secret, Secret, or Confidential, but also is subject to special access and handling 
requirements because it involves or derives from particularly sensitive intelligence sources and 
methods." 28 C.F.R. § 17.18(a). Because of the exceptional sensitivity and vulnerability of such 
information, these safeguards and access requirements exceed the access standards that are 
normally required for information of the same classification level. Specifically, this declaration 
references communications intelligence (COM1NT), also referred to as special intelligence (SI), 
which is a subcategory of SCI. COMJNT or SI identifies SCI that was derived from exploiting 
cryptographic systems or other protected sources by applying methods or techniques, or from 
intercepted foreign communications. 







10 . 



This declaration also contains information 
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related to or derived from the Terrorist Surveillance Program (TSP), a controlled access signals 
intelligence program authorized by the President in response to the attacks of September 1 1, 
2001. Although the President publicly acknowledged the existence of the TSP in December 
2005, details about the program remain highly classified and strictly compartmented. 
Information pertaining to this program is denoted with the special marking ‘TSP” and requires 
more restrictive handling. 




1 1 . -{6) In addition to the fact that classified information contained herein may not be 

revealed to any person without authorization pursuant to Executive Order 12958, as amended, 
this declaration contains information that may not be released to foreign governments, foreign 
nationals, or non-U. S. citizens without permission of the originator and in accordance with DNI 
policy. This information is labeled “NOFORN” The “ORCON” designator means that the 
originator of the information controls to whom it is released. Finally, this document is marked 
Manual Review (“MR”) indicating that it is not subject to automatic declassification at any 
specific date. 
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2 A. (U) Background on The National Security Agency 

3 1 2. (D) The NSA was established by Presidential Directive in 1 952 as a separately 

4 organized agency within the Department of Defense. Under Executive Order 12333, § 1.12(b), 

5 as amended, the NSA’s cryptologic mission includes three functions: (1 ) to collect, process, and 

6 disseminate signals intelligence (SIGINT) information, of which COMrNT is a significant 

7 subset, for (a) national foreign intelligence purposes, (b) counterintelligence purposes, and (c) 

8 the support of military operations; (2) to conduct information security activities; and (3) to 

9 conduct operations security training for the U.S. Government. 

10 13. fFSiVW) Signals intelligence (SIGINT) consists of three subcategories: 

11 (1 ) communications intelligence (COMINT); (2) electronic intelligence (ELINT); and (3) foreign 

1 2 instrumentation signals intelligence (FISINT). Communications intelligence (COMINT) is 

1 3 defined as “all procedures and methods used in the interception of communications and the 

14 obtaining of information from such communications by other than the intended recipients.” 1 8 

1 5 U.S.C. § 798. COMINT includes information derived from the interception of foreign and 

1 6 international communications, such as voice, facsimile, and computer-to- computer information 

1 7 conveyed via a number of means 

18 Electronic intelligence (ELINT) is technical intelligence information derived from 

1 9 foreign non-communications electromagnetic radiations except atomic detonation or radioactive 

20 souxees-in essence, radar systems affiliated with military weapons platforms (e.g., anti-ship) and 

21 civilian systems (e.g., shipboard and air traffic control radars). Foreign instrumentation signals 

22 intelligence (FISINT) is derived from non-U. S. aerospace surfaces and subsurface systems whic 

23 may have either military or civilian applications. 
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14. (S) The NSA’s SIGINT responsibilities include establishing and operating an 
effective unified organization to conduct SIGINT activities set forth in Executive Order No. 
12333, § 1 12(b), as amended. In performing its SIGINT mission, NSA has developed a 
sophisticated worldwide SIGINT collection network that acquires, among other things, foreign 
and international electronic communications and related information. The technological 
infrastructure that supports the NSA’s foreign intelligence information collection network has 
taken years to develop at a cost of billions of dollars and untold human effort. It relies on 
sophisticated collection and processing technology. 

1 5. (U) There are two primary reasons for gathering and analyzing foreign 
intelligence information. The first, and most important, is to gain information required to direct 
U.S. resources as necessary to counter external threats. The second reason is to obtain 
information necessary to the formulation of U.S. foreign policy. Foreign intelligence 
information provided by the NSA is thus relevant to a wide range of important issues, including 
military order of battle; threat warnings and readiness; arras proliferation; international terrorism; 
and foreign aspects of international narcotics trafficking. 

1 6. (S) The NSA’s ability to produce foreign intelligence information depends on its 
access to foreign and international electronic communications. Foreign intelligence produced by 
COMINT activities is an extremely important part of the overall foreign intelligence information 
available to the United States and is often unobtainable by other means. Public disclosure of 
either the capability to collect specific communications or the substance of the information 
derived from such collection itself can easily alert targets to the vulnerability of their 
communications. Disclosure of even a single communication holds the potential of revealing 
intelligence collection techniques that are applied against targets around the world. Once alerted, 

P WRCON/NOFQRN//MR 
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targets can frustrate COMINT collection by using different or new encryption techniques, by 
disseminating disinformation, or by utilizing a different communications link. Such evasion 
techniques may inhibit access to the target’s communications and therefore deny the United 
States access to information crucial to the defense of the United States both at home and abroad. 
COMINT is provided special statutory protection under 18 U.S.C. § 798, which makes it a crime 
to knowingly disclose to an unauthorized person classified information “concerning the 
communication intelligence activities of the United States or any foreign government.” 

B. (U) September 11, 2001 and the al Qaeda Threat. 

17. (U) On September 1 1, 2001, the al Qaeda terrorist network launched a set of 

coordinated attacks along the East Coast of the United States. Four commercial jetliners, each 

carefully selected to be fully loaded with fuel for a transcontinental flight, were hijacked by al 

Qaeda operatives. Those operatives targeted the Nation’s financial center in New York with two 

of the jetliners, which they deliberately flew into the Twin Towers of the World Trade Center. 

Al Qaeda targeted the headquarters of the Nation’s Armed Forces, the Pentagon, with the third 

jetliner. Al Qaeda operatives were apparently headed toward Washington, D.C. with the fourth 

jetliner when passengers struggled with the hijackers and the plane crashed in Shanksville, 

Pennsylvania. The intended target of this fourth jetliner was most evidently the White House or 

the Capitol, strongly suggesting that al Qaeda's intended mission was to strike a decapitation 

blow to the Government of the United States — to kill the President, the Vice President, or 

Members of Congress. The attacks of September 1 1 resulted in approximately 3,000 deaths— 

the highest single-day death toll from hostile foreign attacks in the Nation’s history. In addition, 

these attacks shut down air travel in the United States, disrupted the Nation’s financial markets 

and government operations, and caused billions of dollars of damage to the economy. 
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18. (U) On September 14, 2001, the President declared a national emergency “by 
reason of the terrorist attacks at the World Trade Center, New York, New York, and the 
Pentagon, and the continuing and immediate threat of further attacks on the United States.” 
Proclamation No. 7463, 66 Fed. Reg. 48199 (Sept. 14, 2001). The United States also 
immediately began plans for a military response directed at al Qaeda's training grounds and 
haven in Afghanistan. On September 14, 2001, both Houses of Congress passed a Joint 
Resolution authorizing the President “to use all necessary and appropriate force against those 
nations, organizations, or persons he determines planned, authorized, committed, or aided the 
terrorist attacks” of September 1 1. Authorization for Use of Military Force, Pub. L. No. 107-40 
§ 21(a), 1 15 Stat. 224, 224 (Sept. 18, 2001) (“Cong. Auth ”). Congress also expressly 
acknowledged that the attacks rendered it “necessary and appropriate” for the United States to 
exercise its right “to protect United States citizens both at home and abroad,” and acknowledged 
in particular that “the President has authority under the Constitution to take action to deter and 
prevent acts of international terrorism against the United States.” Id. pmbl. 

19. (U) As the President made clear at the time, the attacks of September 1 1 “created 

a state of armed conflict.” Military Order, § 1(a), 66 Fed. Reg. 57833, 57833 (Nov. 13, 2001). 

Indeed, shortly after the attacks, NATO took the unprecedented step of invoking article 5 of the 

North Atlantic Treaty, which provides that an “armed attack against one or more of [the parties] 

shall be considered an attack against them all.” North Atlantic Treaty, Apr. 4, 1949, art. 5, 63 

Stat. 224 1 , 2244, 34 U.N.T.S. 243, 246. The President also determined that al Qaeda terrorists 

“possess both the capability and the intention to undertake further terrorist attacks against the 

United States that, if not detected and prevented, will cause mass deaths, mass injuries, and 

massive destruction of property, and may place at risk the continuity of the operations of the 
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United States Government,” and he concluded that “an extraordinary emergency exists for 



national defense purposes.” Military Order, § 1(c), (g), 66 Fed. Reg. at 57833-34. 

20. (U) As a result of the unprecedented attacks of September 1 1 , 2001, the United 

States found itself immediately propelled into a worldwide war against a network of terrorist 
groups, centered on and affiliated with al Qaeda, that possesses the evolving capability and 
intention of inflicting further catastrophic attacks on the United States. That war is continuing 
today, at home as well as abroad. Moreover, the war against al Qaeda and its allies is a very 
different kind of war, against a very different enemy, than any other war or enemy the Nation has 
previously faced. Al Qaeda and its supporters operate not as a traditional nation-state but as a 
diffuse, decentralized global network of individuals, cells, and loosely associated, often disparate 
groups, that act sometimes in concert, sometimes independently, and sometimes in the United 
States, but always in secret — and their mission is to destroy lives and to disrupt a way of life 
through terrorist acts. Al Qaeda works in the shadows, secrecy is essential to al Qaeda’s success 
in plotting and executing its terrorist attacks. 



21. (T S // 6 1//NF) The In Camera Declaration of Michael McConnell, Director of 

National Intelligence, details the particular facets of the continuing al Qaeda threat and, thus, the 
exigent need for the NSA intelligence activities described here. The NSA activities are directed 




Global telecommunications networks, especially the Internet, have developed in recent years into 

a loosely interconnected system— a network of networks — that is ideally suited for the secret 

communications needs of loosely affiliated terrorist cells. Hundreds of Internet service 
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providers, or “ISPs,” and other providers of communications sendees offer a wide variety of 
global communications options, often free of charge. 




es Mara ;it;nw3iSTiEi 



against at t^aeda and its atnliates therefore present cnticai 



challenges for the Nation’s communications intelligence capabilities. First, in this new kind of 
war, more than in any other we have ever faced, communications intelligence is essential to our 
ability to identify the enemy and to detect and disrupt its plans for further attacks on the United 





1 States. Communications Intelligence often is the only means we have to leam the identities of 

2 particular individuals who are involved in terrorist activities and the existence of particular 

3 terrorist threats. Second, at the same time that communications intelligence is more important 
than ever, the decentralized, non-hierarchical nature of the enemy and their sophistication in 

5 exploiting the agility of modem telecommunications make successful communications 

6 intelligence more difficult than ever. 

C. (U) NSA Activities Critical to Meeting al Qaeda Threat. 

fS S P//OC/N F> To meet these challenges and to help detect 

9 and prevent another catastrophic terrorist attack within the United States, the NSA has utilized a 

10 number of critically important intelligence tools. One such tool was the Terrorist Surveillance 
1 .1 Program, which the President authorized specifically to detect and prevent al Qaeda-related 

12 terrorist attacks within the United States. Pursuant the TSP, the NSA was authorized to intercept 

1 3 the content 4 of telephone and Internet communications for which there were reasonable grounds 

1 4 to believe that ( 1 ) such communication originated or terminated outside the United States, and 

15 (2) a party to such communication was a member or agent of al Qaeda or an affiliated terrorist 

16 organization. 5 



(T S //S I//T S P//OC/N F) The term “content” is used herein to refer to the substance, 
18 meaning, or purport of a communication, as defined in 18 U.S C. § 2510(8), as opposed to the 
type of addressing or routing information referred throughout this declaration as “meta data.” 



(F S flBl l B /TSP//OC/NF) 
k 2001, and was reauthorized approx 



1 1 f' Ml il MV/OUMi ) The TSP was first authorized by the President on 

20 October 4, 2001, and was reauthorized approximately every 30-60 days throughout the existence 
of the program. The Presidential documents authorizing the TSP also contained the 

2 1 authorizations for the meta data activities described herein. The Presidential authorizations, 
moreover, evolved over time, and during certain periods authorized other activities (this 

22 declaration is not intended to and does not fully describe the President’s authorizations and the 
diffe 
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25. (TS//S I//T S fV/0€/N F) On January 10, 2007, the FISA Court issued two orders 

authorizing the Government to conduct certain electronic surveillance that had been occurring 



3 under the TSP. As explained more fully below, see Section VI.B.5, infra, the orders consisted o 



5 and a Foreign Telephone Email Order, 

6 inter alia , electronic surveillance of telephone and Internet communications carried over 
particularly listed facilities when the Government determines that there is probable cause to 

8 believe that (1) one of the communicants is a member or agent of al Qaeda or an associated 

9 terrorist organization, and (2) the communication is to or from a foreign country (i.e., a one-end 

1 0 foreign communication to or from the United States). The telephone numbers and email 

1 1 addresses to be targeted under the Foreign Telephone and Email Order were further limited to 

1 2 those that the NS A reasonably believes are being used by persons outside the United States. 

1 3 26. f T S //Sl//T -SP/( QC/NF ) In light of these intervening FISA Court orders, any 

1 4 electronic surveillance that was occurring as part of the TSP is now being conducted subject to 

1 5 the approval of the FISA Court, and the President determined not to reauthorize the TSP. As 

16 described further in Section VI.B.5, infra , and as the United States notified this Court on April 9, 

1 7 2007, a Judge of the FISA Court recentl 

18 declined to adopt the Government’s interpretation of FISA underlying the application for the 

19 Foreign Telephone and Email Order. The initial authorization to conduct surveillance under the 



1 62, MDL No. 06-1791 -VRW (N.D. Ca^Hrelatin^^l^ction^Bainsnh^MC^n^Verizon 
22 Defendants) (submitted Anr. 20. 2007). [ I 
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Foreign Telephone and Email Order, however, has been extended through May 3 1 , 2007. 
Further proceedings before the FISA Court are ongoing, and the TSP has not been reauthorized. 



27. In addition to the TSP, the NSA also collects 

non-content communication information known as “meta data.” Specifically, after the 9/1 1 
attacks, the President authorized the NSA to collect bulk meta data related to telephony 

communications tor the purpose of conducting targeted analysts. 

| Telephony meta data is information derived from call detail records that reflect non- 

content information such as the date, time, and duration of telephone calls, as well as the phone 

numbers used to place ;ind receive the calls. | * 

| since May 2006 certain telecommunication providers 
have been required by an order of the FISA Court to produce to the NSA on a daily basis all 



telephony meta data that they create (“FISC Telephone Records Order”) 6 Although this 
collection is broad in scope, 7 the NSA queries the data solely with identified telephone numbers 
for which there are facts giving rise to a reasonable, articulable suspicion that the number is 



associated wit 



Historically, only a tiny fraction 



of telephony meta data records collected by the NSA has actually been presented to a trained 



( TS// S t// O C/NF) The FISC Telephone Records Order has been reauthorized 
approximately every 90 days since it was first issued. 



Il ' 1 I 1 1 I 1 ' * H i I'H I I mi before the FISC issued its Telephone Records 

Order, the NSA operated under very similar requirements for accessing the meta data collected 
pursuant to the President's authorization. 
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1 professional for analysis. While the vast majority of records are thus never viewed by a human 

2 at the NSA, it is still necessary to collect the meta data in bulk in order to utilize sophisticated 

3 analytical tools for tracking the contac 

4 Telephony meta data collection and analysis are highly valuable tools for tracking 

5 terrorists and are therefore highly classified and strictly compartmented. 

6 28. S P//OC/N F) In addition, since the 9/1 1 attacks, tire NSA 

7 has collected bulk meta data related to Internet communications. Internet meta data is 

8 header/router/addressing information, such as the “to,” “from,” “cc,” and “bcc” lines, as opposed 

9 to the body or “re” lines, of a standard email. The collection of Internet meta data in bulk was 



10 conducted pursuant to Presidential authorization from October 2001 



and since 



1 1 July 2004 it has been conducted pursuant to an Order of the Foreign Intelligence Surveillance 

1 2 Court authorizing the use of a pen register and trap and trace device (“FISC Pen Register 

1 3 Order”). See 1 8 U.S.C. § 3127 (defining “pen register” and “trap and trace device”). Pursuant to 

14 the FISC Pen Register Order, which has been reauthorized approximately every 90 days since it 

15 was first issued, the NSA is authorized to collect, in bulk, meta data associated with electronic 



16 communications 



on the Internet 



Although the NSA collects email meta data in 
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bulk it is only authorized to query the archived meta data using email 

addresses for which there are facts giving rise to a reasonable, articulable suspicion that the email] 
i v. m 

in place under the Presidential authorization). As with bulk telephony meta data collection, and 
as the FISA Court specifically recognized in finding the bulk Internet meta data collection 
consistent with the First and Fourth Amendments, the collection of the data in bulk is necessary 
to allow the NSA to use critical and unique analytical capabilities to track the contacts (even 
y ) . • : 

activities, Internet meta data collection and analysis are highly valuable tools for protecting the 
United States from attack, and, accordingly, information pertaining to those activities is highly 
classified and strictly compartmented. 

29. f T -S/VSI 
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On July 14, 2004, the FISC issued the Pen Register Order, 
restoring the bulk collection of Internet meta data as described above. 

V. (U) Information Protected by Privilege 
31. (U) As set forth further below, the following categories of information are subject 

to the DNI’s assertion of the state secrets privilege and statutory privilege under the National 
Security Act, as well as my assertion of the NSA privilege: 



(TS//SI//TSP//OC/NF) As noted, the President reauthorized the TSP, as well as the 
Internet and telephony meta data activities, approximately every 30-60 days, and each time he 
did so in a single document covering all three activities (and, at times, other activities). See n.5, 
supra. 



DIRECTOR. NATIONAL SECURITY AGENCY 
CASE NO. 07-693; MDLNO. 06-1791 






1W1 c 

A. 


UV. J\L 1 //V/V/lVllll 1 r l <-71 ' i 'll i V'-'J. 

(U) Information that may tend to confirm or deny whether 
the Plaintiffs have been subject to any alleged NSA 
intelligence activity that may be at issue in this matter; and 


B. 


(U) Information concerning NSA intelligence activities, 
sources, or methods, including: 




(1) (U) Information concerning the scope and operation of 
the Terrorist Surveillance Program, including information 
that may be needed to demonstrate that the TSP was limited 
to one-end foreign a! Qaeda-related communications and 
that the NSA does not otherwise engage in the content 
surveillance dragnet that the Plaintiffs allege; and 




(2) (U) Any other information concerning NSA intelligence 
activities, sources, or methods that would be necessary to 
adjudicate the Plaintiffs' claims, including, to the extent 
applicable, information that would tend to confirm or deny 
whether the NSA collects large quantities of 
communication records information; and 


C. 


(U) Information that may tend to confirm or deny whether 
Verizon/MCI, AT&T, or any other telecommunications 
earner has assisted the NSA with the alleged intelligence 
activities. 




iHO'-iuirntudi'i i«['i f’-rjii i 



A. (U) Information That May Tend to Confirm or Deny Whether the Plaintiffs Have 
Been Subject to Any Alleged NSA Activities That May Be at Issue in This Matter 

32. (U) The first category of information as to which I am supporting the DNl’s 

assertion of privilege, and asserting the NSA’s own statutory privilege, concerns information as 

to whether particular individuals, including the named Plaintiffs in this lawsuit, have been 

subject to alleged NSA intelligence activities. As set forth below, confirmation or denial of such 

information would cause exceptionally grave harm to national security. 
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33. (T S ZZ S LZATSPZ/OC/N - F ) The named Plaintiffs in this action — Virginia Shubert, 
Noha Aiafa, Sarah Dranoff, and Hilary Botein — allege that the contents of their telephone and 
Internet communications were subject to “unlawful interception, search and seizure, and 
electronic surveillance,” Amended Corapl. H 87, in connection with a program of “dragnet” 
surveillance that captures the contents of ‘Virtually every telephone, internet and/or email 
communication that has been sent from or received within the United States since 200 1 



id. DU 1, 4. The NS A does not engage in the “dragnet” program that Plaintiffs allege, 
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First, as a matter of course, the NSA cannot publicly confirm 
or deny whether any individual is subject to the surveillance activities described herein, because 
to do so would tend to reveal actual targets. For example, if the NSA were to confirm in this 
case and others that specific individuals are not targets of surveillance, but later refuse to 
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37. QC'/N F) Disclosing any of this information would reveal 
some of the Nation's most sensitive and important intelligence-gathering methods. For reasons 
already discussed, such disclosures would cause exceptionally grave damage to the national 
security by allowing al Qaeda and its affiliates to evade detection, as well as by alerting other 
foreign adversaries to these critical intelligence- gathering methods. Disclosing whether the NSA 

violate specific provisions of the FISC Telephone Records and FISC Pen Register Orders. 

B. (U) Information Concerning NSA Activities, Sources, or Methods, and the Harm of 

Disclosure. 

38. (U) The second category of information over which I am supporting the DNl’s 
assertion of privilege and asserting the NSA’s statutory privilege is information concerning NSA 
intelligence activities, sources, and methods that may at issue in this case, including (1) facts 
concerning the operation of the Terrorist Surveillance Program and any other NSA intelligence 
activities needed to demonstrate that the TSP was limited as the President stated to the 
interception of one-end foreign communications reasonably believed to involve a member or 
agent of al Qaeda or an affiliated terrorist organization, see H 24 & n.5, supra , and that the NSA 
does not otherwise conduct a dragnet of content surveillance as the Plaintiffs allege; (2) other 
classified facts about the operation of the TSP that would be necessary to adjudicate the 
lawfulness of that program; and (3) facts that would confirm or deny whether the NSA collects 
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large quantities of communication records information. As set forth below, the disclosure of 
such information would cause exceptionally grave harm to national security. 

1. (U) Information Concerning Plaintiffs’ Allegations of a Content Surveillance 

“Dragnet” 

39. (U) In December 2005, President Bush explained that, after the September 1 1 

attacks, he authorized the NS A to intercept the content of certain communications for which 
there are reasonable grounds to believe that (1 ) such communication originated or terminated 
outside the United States, and (2) a party to such communication is a member or agent of al 
Qaeda or an affiliated terrorist organization. The President stated at the time that this activity, 
now referred to as the Terrorist Surveillance Program, did not involve the collection of purely 
domestic communications, or international communications with no al Qaeda connection, and 
these facts were reiterated publicly by the Attorney General and then-Dcputy Director of 
National Intelligence. Nonetheless, 1 am advised that the Plaintiffs have alleged that, pursuant to 
a secret NSA program, “virtually every telephone, internet and/or email communication that has 
been sent from or received within the United States since 2001 has been (and continues to be) 
searched, seized, intercepted, and subjected to surveillance without a warrant, court order or any 
other lawful authorization.” Amended Compl. 11. As the President made clear in describing th 
limited scope of the TSP, such allegations of a content surveillance dragnet are false. But if the 
NSA had to demonstrate in this case that the TSP was limited as the President stated, and not a 
dragnet as the Plaintiffs claim, and that the NSA does not otherwise engage in the dragnet that 
Plaintiffs allege, sensitive and classified facts about the operation of the TSP and NSA 
intelligence activities would have to be disclosed. 



40. (T S//SI//TSP//OC/NF ) The privileged information that must be protected from 
disclosure includes the following classified details demonstrating the limited nature of the TSP. 
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First, interception of the content of communications under the TSP was triggered by a range of 
information, including sensitive foreign intelligence, obtained or derived from various sources 
indicating that a particular phone number or email address is reasonably believed by the U.S. 
Intelligence Community to be associated with a member or agent of al Qaeda or an affiliated 
terrorist organization. Professional intelligence officers at the NSA undertook a careful but 
expeditious analysis of that information, and considered a number of possible factors, in 
determining whether it would be appropriate to target a telephone number or email address under 
the TSP. Those factors included whether the target phone number or email address was: 

(1) reasonably believed by the U.S. Intelligence Community, based on other authorized 
collection activities or other law enforcement or intelligence sources, to be used by a member or 
agent of al Qaeda or an affiliated terrorist organization;! 






4 1 . (T 8 // 8 I//T S py/OC/N F) Once the NSA determined that there were reasonable 

grounds to believe that the target is a member or agent of al Qaeda or an affiliated terrorist 
organization, the NSA took steps to focus the interception on the specific al Qaeda-related target 
and on communications of that target that are to or from a foreign country. In this respect, the 



NSA’s collection efforts were 



at the NSA had 



reasonable grounds to believe carry the “one end" foreign communications of members or agents 
of al Qaeda or affiliated terrorist organizations. 
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44 The NSA took specific steps in the actual TSP 

interception process to minimize the risk that the communications of non-targets were 
intercepted. With respect to telephone communications, specific telephone numbers identified 
through the analysis outlined above were 




so that the only communications 
intercepted were those to or from the targeted number of an individual who was reasonably 
believed to be a member or agent of al Qaeda or an affiliated terrorist organization. For Internet 

2 communications, the NSA used identifying information obtained through its analysis of the 

3 target, such as email addresses to target for collection the communications of 

4 individuals reasonably believed to be members or agents of al Qaeda or an affiliated terrorist 

5 organization. 16 
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TOP-S E €ftET//COMft fF^^^M‘ ffSWORCOfWOrORN//MR 
45. (T 8// S I//T S P//OC/NF) In addition to procedures designed to ensure that the TSP 
was limited to the international communications of al Qaeda members and affiliates, the NSA 
also took additional steps to ensure that the privacy rights of U.S. persons were protected. 
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46. - ( TS//SI //T SP / /OC/ N F) 



17 (U /FOUO ) In addition, in implementing the TSP, the NSA applied the existing Legal 
Compliance and Minimization Procedures applicable to U.S. persons to the extent not 
inconsistent with the President's authorization. See United States Signals Intelligence Directive 
(USSID) 18. These procedures require that the NSA refrain from intentionally acquiring the 
communications of U.S. persons who are not the targets of its surveillance activities, that it 
destroy upon recognition any communications solely between or among persons in the U.S. that 
it inadvertently acquires, and that it refrain from identifying U.S. persons in its intelligence 
reports unless a senior NSA official determines that the recipient of the report requires such 
information in order to perform a lawful function assigned to it and the identity of the U S. 
person is necessary to understand the foreign intelligence or to assess its significance. 
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47. (T S H S I//T S P / /OC/N F) In addition to these facts about the TSP, facts about other 

NSA intelligence activities would be needed to explain or prove that the NSA does not conduct a 
dragnet as Plaintiffs allege. 



None of these activities, however, could be disclosed to address and rebu 
Plaintiffs’ dragnet allegations without causing exceptionally grave damage to the national 
security. 

2. (U) Additional Classified Information Concerning the TSP 

48. (U) To the extent the Plaintiffs in this case are challenging the lawfulness of the 

TSP itself, facts about the operation of that program (which remain highly classified) also could 
not be disclosed. 
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49. ( T S //SI//TSP//OC/NF) For example, in conjunction with meta data analysis, the 
TSP provided far greater operational swiftness and effectiveness for identifying the al Qaeda 
terrorist network in the United States than the traditional procedures that had been used under the 
Foreign Intelligence Surveillance Act. In order to ascertain as rapidly as possible the potential al 
Qaeda terrorist threats facing the United States, the NSA must know not only what a foreign 
terrorist target says in a particular telephone or Internet intercept, but with whom that person has 
been communicating. To the extent individual court orders for all TSP targets could have been 
required in advance under traditional FISA procedures, the NSA would have been unable to 
target communications sent to and from new phone numbers or Internet accounts as quickly, and 
valuable intelligence could have been lost. 



50. (T S // S I//T S P//OC/NF) As noted, 




ie TSP, in conjunction with meta data collection and analysis.) 
allowed the NSA to obtain rapidly not only the content of a particular communication, but 
connections between that target and others who may form a web of al Qaeda conspirators. In 
some cases, the NSA was able to begin collection on a target phone number in | 

to begin collection on a targeted phone number or 
email address. In contrast, if individual applications have to be prepared and approved through 
the traditional FISA process before the NSA can target a newly identified phone number or email 
account associated with al Qaeda, vital information could be lost in the interim. The traditional 
FISA process is a highly effective tool for many types of surveillance activities, I 
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would have had 

to stop and demonstrate, through a multi-layered process involving NSA and DOJ counsel, the 
Attorney General, and the FISA Court, that each of numerous, rapidly changing target numbers 
or emails requires coverage. Where the gravest of dangers are at stake — a catastrophic mass 
casualty terrorist attack against the U.S. Homeland and the corresponding need to track 

where 

^ hide their communications and tracks, it is vital that the NSA be able to track multiple 
communications, contacts, and |^^|as rapidly as possible to fulfill its mission to protect the 
national security of the United States. 

5 1 . (TS//SI//T S F//OC/NF ) None of the foregoing information about the Terrorist 

Surveillance Program could be disclosed in this case, however, without causing exceptionally 
grave harm to the national security. Even though the President has determined not to reauthorize 



the TSP, revealing how the program operated would provide key insights to foreign adversaries 
as to how the NSA monitors communications. Information about the specific foreign 
intelligence factors that triggered interception under the TSP would obviously reveal to foreign 
adversaries the very facts that would most likely lead to their communications being intercepted, 
even under the current FISA Court Orders, thereby giving adversaries a roadmap as to how to 
avoid such interception. 
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52. (TS// 8 I//T S P//OC/NF) Likewise, information about the speed and agility with 

which the MSA can collect content on a target, and how long it might maintain surveillance, 

would provide invaluable insights for an adversary to devise new and different ways to protect 

their communications. In particular, disclosure of the NSA ’s ability to utilize the TSP (or, 

therefore, the current FISA Court-authorized content collection) in conjunction with contact 

chaining undermine efforts to detect terrorist 

Armed with this knowledge, an adversary could make more robust use | 

l 





Compromise of one NSA 
method of surveillance, even no longer in use, can easily lead to evasive actions as to other 
current methods that would deprive U.S. decision-makeTS of critical information needed to detect 
-orist threats. 

3. (S) Information Concerning Meta Data Activities 

53. I I X 7NI'"i In the extent that the NSA’s bulk collection and 

targeted analysis of communication meta data may be at issue in this case, those activities — as 
described in paragraphs 27 and 28, above — must also be protected from disclosure. 

54. I I 1 '''il ill I'll | mil 1 1 ih i i i n i n 1 1 in i ii i 1 1 i i mil mil nn 

pursuant to the FISC Pen Register Order, the NSA collected bulk meta data associated with 
electronic communications 
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( I 1 'il'i'i 1 ! II i'i'I 1 ! I M in capability provided by meta data 

analysis may be illustrated by an example of when this tool was not utilized. According to the 
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I l H I i HI I H I I I I I I i I i i H I I i H i II I II 

9/1 1 Commission report, when Khalid al-Mihdhar, one of the 9/1 1 hijackers, was in the United 
States from January 2000 to June 2001, he telephoned the home of his wife’s family in Yemen. 
The phone number for this home in Yemen had well-established terrorist connections 19 and was 
being targeted by the NSA through an overseas collection process that did not have the capability 
to obtain meta data to help identify the location of incoming calls. At the time, there was no 
FISA collection on this number, and neither the TSP program, under which the NSA targeted 
one-end foreign calls into the United States, nor the collection of bulk meta data, which would 
have allowed analysis of this number to ascertain other contact numbers, were in place. Had the 
Yemeni phone number been targeted using the TSP and were meta data analysis available, wc 
should have been able to identify that al-Mihdhar was in the United States when he called the 
number in Yemen, which would have provided leads to investigate the matter further. Indeed, 
the 9/1 1 Commission report noted that if the FBI had known that al Mihdhar was in the United 
States, “investigations or interrogation of [al Mihdhar], and investigation of [his] travel and 
financial activities could have yielded evidence of connections to other participants in the 9/1 1 
plot. The simple fact of [his] detention could have derailed the plan. In any case, the 
opportunity did not arise.’’ Final Report of the National Commission on Terrorist Attacks Upon 
the United States (“9/1 1 Commission Report”) at 272. While there is an element of hindsight to 
this example, and perhaps other actions could have detected al Mihdhar, the existence of the TSP 
and meta data activities would have provided a highly significant tool that may have proved 
valuable in detecting the 9/1 1 plot. 



19 (TSffSfr / NF) In August 1998, the 



number was found in the pocket of one of the 




Hit. 
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59. IV/OC/N F) Based on my experience as Director of the 

2 NS A, I believe that the meta data collection activities authorized by the President after 9/1 1 and 

3 subsequently authorized by the FISC are among the most important intelligence tools available 
to the United States for protecting the Homeland from another catastrophic terrorist attack. In 

5 my view, the NSA could not have obtained certain critical intelligence in any other way. These 

6 NSA activities have given the United States unparalleled ability to understand I 




If employed on a sufficient volume of raw data. 



contact chainin 



can expose 



and contacts that 



9 [ were previously unknown. Meta data collection thus enables the NSA to segregate some of that 

1 0 very small amount of otherwise undetectable but highly valuable information from the 

1 1 overwhelming amount of other information that has no intelligence value whatsoever — in 

1 2 colloquial terms, to find at least some of the needles hidden in the haystack. 




Disclosure or confirmation of the NSA’s bulk collection and targeted analysis 
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of telephony meta data would confirm to all of our foreign adversaries 
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e existence of these critical intelligence capabilities and thereby severely undermine 
NSA’s ability to gather information concerning terrorist connections. 

4. 



Information Demonstrating the Success of the 
TSP and Meta Data Activities. 

60. (T S // S D/T 8 P //O CV N F ) Specific examples of how the TSP, in conjunction with 
meta data analysis, led to the development by the NSA of actionable intelligence and important 
counter-terrorism efforts help illustrate the effectiveness and need for the activities. To the 
extent that such examples would be relevant to any defense of this action, however, those 
examples could not be disclosed without revealing specific NSA intelligence information, 
sources, and methods. For instance: 
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61 . (T S // & I /flF S P//OC/N F) Information about any of the successes of NSA activities 

would not only be revealing of the substantive knowledge of the United States Government as to 
terrorist plans and activities, but would also tend to reveal or confirm to all of our foreign 
adversaries the sources and methods by which the United States obtained such information. 

5. (€) Information Concerning FISC Orders. 



62. 



-f'FV-Ni | 



/ TS-fY /OG'/NF) Next, to the extent relevant to the litigation ot| 

this case, information concerning the various orders of the Foreign Intelligence Surveillance 

Court mentioned throughout this declaration must also remain protected from public disclosure. 

As discussed above, three NSA intelligence activities authorized by the President after the 

September 1 1 attacks to detect and prevent a further al Qaeda attack — the TSP, Lntemct rneta 

data collection, and telephony meta data collection — have been subject to various orders of the 

FISC and are no longer being conducted under Presidential authorization. The very existence of 

the meta data FISC orders — the FISC Pen Register Order (first issued in July 2004) and the FISC) 

Telephone Records Order (first issued in May 2006) — remains classified. The President 

authorized the disclosure of the general existence of the January 10, 2007 FISC orders that 
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authorized electronic surveillance of 



individuals in a manner similar to that 



undertaken in the TSP, and President’s authorization of the TSP lapsed in February 2007. 
Information that may reveal the existence of the undisclosed FISC orders or the substance of any 
of these orders should be protected from disclosure. 



63, 1 1 n'lVI'i I ii ii 1 1 1 1 m ' of information about and within the 

FISC orders would obviously reveal intelligence sources and methods currently being utilized by 
the NSA under Court order and, thus, would cause exceptional harm to national security. For 

8 example, as discussed above, the FISC Telephone Records Order requires certain 

9 telecommunication companies to produce all of their telephony meta data to the NSA on a daily 

1 0 basis and authorizes the NSA to access its archive of collected telephony meta data only when 

1 1 the NSA has identified a known telephone number reasonably suspected to be associated with 

The number 

1 3 believed to be used by a U.S. person shall not be regarded as associated with 

solely on the basis of activities that are protected by the First 
1 5 II Amendment. The FISC Pen Register Order authorizes the use of a pen register and trap and 



1 6 trace device to collect Internet meta data 



on similar 



1 7 terms. Disclosure of these facts would reveal sensitive sources and methods utilized by the NSA 



1 8 to obtain data utilized to track 



ntacts of 



( I l< iVNI'i For this reason, the FISC Telephone Records Order and 

20 FISC Pen Register Ord^^^mubit any person from disclosing to any other person that the NSA 
has sought or obtained the telephony meta data, other than to (a) those persons to whom 

2 1 disclosure is necessary to comply with the Order; (b) an attorney to obtain legal advice or 
assistance with respect to the production of meta data in response to the Order; or (c) other 

22 persons as permitted by the Director of the FBI or the Director’s designee. The FISC Orders 
further provide that any person to whom disclosure is made pursuant to (a), (b), or (c) shall be 

23 subject to the nondisclosure requirements applicable to a person to whom the Order is directed in 
the same manner as such person. 
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64. -fF6//Sf^J^^p¥ OC//NF) The intelligence activities authorized by the FISC 

Pen Register and FISC Telephone Records Orders must not be compromised by the disclosure o 
other information. For example, as discussed above, the disclosure of 



Thus, any attempt to address the lawfulness of the meta data activities under Presidential 
authorization prior to the FISC orders would directly risk disclosure of current NSA operations 



under FISC Orders. 



^ < U 'JIM y 4 



The disclosure of information concerning the 



recent FISC Orders authorizing electronic surveillance would also harm national security. The 
January ) 0, 2007 Foreign Telephone and Email Order authorized, among other things, electronic 
surveillance of telephone and Internet communications 
when the Government determines that there is probable cause to believe that (1) one of the 



communicants is a member or agent of 



and (2) 



the communication is to or from a foreign country, i.e., a one-end foreign communication to or 

1 8 from the United States 51 The telephone numbers and email addresses to be targeted (i.e., 

1 9 “selectors") under this order were further limited to those that the NSA reasonably believes arc 

20 being used by persons outside the United States. Under the order, every 30 days the Government 

2 1 is required to submit a report to the FISA Court listing new selectors that the NSA has targeted 




fact, which is not relevant to this action, is, like 

the other details in the orders, highly classified. 
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during the previous 30 days and briefly summarizing the basis for the NSA’s determination that 
the probable cause standard has been met. 
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66. (T S //S I//OC//N F) The surveillance under this new FISA Court Foreign 
Telephone and Email Order, which is subject to detailed minimization and oversight procedures, 
was authorized for 90 days and indicated that it may be reauthorized by the FISA Court upon 
application by the Attorney General. The order states that, with each request for reauthorization, 
the Government is required to present a list of current selectors previously reported to the FISA 
Court that the Government intends to continue to task for collection under the reauthorization. 
The order further indicated that, at any time, the FISA Court may request additional information 
regarding particular selectors, and, if the Court finds that the applicable probable cause standard 
is not met, it may direct that the surveillance under the order shall cease on the selector(s) in 
question. This non-traditional order allowed the Government to target for collection 
communications related to new selectors used by terrorists 

having to seek advance approval from the FISA Court for each individual selector. Upon the 
initiation of the surveillance authorized under the Foreign Telephone and Email Order, the NSA 
monitored 

selectors occurred over a 90-day period. 



ov 




oreign selectors. 



the reporting of these initial 
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however, did not grant the Government’s application to renew the 

4 surveillance authority in the Foreign Telephone and Email Order (concerning surveillance 

5 targeting telephone numbers and e-mail addresses reasonably believed to be used by persons 

6 outside the United States). Rather, it issued an Order and Memorandum opinion on April 3, 

7 2007, declining to adopt the interpretation of the Foreign Intelligence Surveillance Act 

8 underlying the Government’s application for the Foreign Telephone and Email Order. The Court 

9 nevertheless ordered that the Government could submit an application for a single extension of 

1 0 the Foreign Telephone and Email Order to May 3 1 , 2007. The Court contemplated that an 

1 1 extension of surveillance authority to May 3 1 would allow the Government to submit an 

12 application that might permit the Court “to authorize at least part of the [requested] surveillance 

13 in a manner consistent with [its] order and opinion." On the Government’s application, the 

14 Court granted a separate order issued on April 5, 2007, extending the surveillance authority 

1 5 granted by the Foreign Telephone and Email Order to May 3 1 , 2007. 

1 6 69. (TS//S1//OC//HF) The Government has reviewed the new FISA Court orders and 

1 7 is working closely with the FISA Court in the hopes of developing an approach for continuing 

1 8 the authorized surveillance beyond May 31, 2007, in a manneT consistent with the April 3, 2007, 

19 order of the FISA Court. The details of these orders, and targets implicated by the orders, like 

20 the operational details and targets of the ongoing FISA Court-approved surveillance, are highly 

2 1 classified. Thus, information about the nature of these recent FISC orders should not be 

22 disclosed in this case. 
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c. 



(U) Information That May Tend to Confirm or Deny Whether Verizon/MCI and/or 
AT&T Has Assisted the NSA with the Alleged Intelligence Activities 

70. (U) The third major category of information as to which I am supporting the 

DNI’s assertion of privilege, and asserting the NSA’s statutory privilege, concerns information 

that may tend to confirm or deny whether Verizon/MC! and/or AT&T has assisted the NSA with 

the alleged intelligence activities. As set forth below, confirmation or denial of such information 

would cause exceptionally grave harm to national security. 



Plaintiffs allege that they are customers of 



Verizon and/or AT&T, and that those companies participate in the content surveillance dragnet 
that Plaintiffs allege. See Amended Compl. 5-8. Neither company has participated in the 
alleged dragnet, because such a program does not exist. 
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82. -fTS//S4-^^^^|j/0€/?VF^-Upon examination of the allegations, claims, facts, 

and issues raised by this case, it is my judgment that sensitive state secrets are so central to the 



1 5 subject matter of the litigation that any attempt to proceed will substantially risk the disclosure on 




6 the privileged state secrets described above. Although Plaintiffs challenge an alleged content 
1 7 surveillance dragnet that does not exist, proving why that is so 



would directly implicate highly classified 



1 9 intelligence information and activities. 



In my judgment, any 

effort to probe the outer-bounds of such classified information would pose inherent and 
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and the government faces significant obstacles in finding and tracking agents of al Qaeda as they 
manipulate modem technology in an attempt to communicate while remaining undetected. The 
NSA activities described herein are vital tools in this effort. 
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86. (S) For the foregoing reasons, in my judgment the disclosure of the information 

discussed herein would cause exceptionally grave damage to the national security of the United 
States. In addition to upholding the state secret s privilege and statutory privilege assertions by 
the Director of National Intelligence in this case, I request that the Court also uphold my 
assertion of NSA’s statutory privilege to protect information about NSA activities. Finally, it is 
my view that continued litigation of this lawsuit would risk the disclosure of sensitive classified 
information and, accordingly, that the Court should not only protect from disclosure the 
classified information described herein but dismiss this lawsuit. 

1 declare under penalty of peijury that the foregoing is true and correct. 
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Director, National Security Agency 
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